SEKOIA_Backdoor_Win_Blackrat

import "pe"
import "hash"

rule SEKOIA_Backdoor_Win_Blackrat : FILE
{
	meta:
		description = "Detect Andariel's Black RAT malware"
		author = "Sekoia.io"
		id = "3a5a6290-6344-45ce-8929-ea5a4451840f"
		date = "2023-09-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/backdoor_win_blackrat.yar#L4-L33"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "c2500a6e12f22b16e221ba01952b69c92278cd05632283d8b84c55c916efe27c"
		logic_hash = "4edf1335e357ebc02e4abb51cd8d808ae39e649cf19cdb3ec667c9cf313181a9"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "I:/01___Tools/02__RAT/Black/Client_Go/Client.go"
		$s2 = "I:/01___Tools/02__RAT/Black/Client_Go/Define.go"
		$s3 = "I:/01___Tools/02__RAT/Black/Client_Go/Screenshot.go"
		$x1 = "RAT/Black/Client"

	condition:
		uint16be( 0 ) == 0x4d5a and ( all of ( $s* ) or #x1 >= 3 ) or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "74c4cdc9d33fc63aee7ae9659b6f8d24" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "298948afbe85985025e176605ee21176" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "e5ca54c5def3c7a950e6d4034dc86277" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "440ae899aea859458df5b6de7dbc5b34" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "98e46f76b965ffb58f6cd53ff8dc91c0" )
}